wavePod

Get Wave AI

162: Hieu - Darknet Diaries | Wave AI Podcast Notes

Back to Darknet Diaries

162: Hieu

Darknet Diaries

Tue Aug 05 2025

Summary

Darknet Diaries – Episode 162: Hieu

Host: Jack Rhysider
Guest: Hugh Mingo (aka “Hieu”)
Date: August 5, 2025

Episode Overview

In this episode, Jack Rhysider interviews Hugh Mingo, a Vietnamese hacker turned cybercrime investigator, about his rise from a teenage hacker in rural Vietnam to one of the world’s most prolific sellers of stolen personal data, and ultimately his arrest and transformation. The episode exposes the shady underbelly of the online data broker industry, the mechanics and mindset of large-scale identity theft, and the troubling legal gray areas around data privacy and prosecution. Hieu’s story raises deeper questions about privacy, personal data, and the ethics of the information economy.

Key Discussion Points

1. Hieu’s Early Days in Vietnam (00:10 – 05:41)

Hieu grew up in Cambran, Vietnam, developing an early fascination with computers and the internet.
The prohibitive cost of internet access inspired him to hack and steal dial-up ISP accounts at age 14-15.
“That’s one reason that I started to hack and steal a few Internet dial accounts to be able to use it without paying … my first time, I got into trouble when I was like 15 years old.” (00:10 – Hieu)
After doing $5,000 in damage, his father sent him to Ho Chi Minh City for better schooling—and unintendedly, closer to the hacking underground.

2. Falling Into the Darknet (05:41 – 09:38)

In Ho Chi Minh City, Hieu’s computer skills accelerated. An encounter in an internet café introduced him to Vietnam’s “dark web” forums:
“The moment I’ve been there, I passed one of the computer screens … dark background … green color … this is about the dark web in Vietnam.” (05:58 – Hieu)
He became obsessed with hacking forums, learning vulnerabilities, sharing techniques, and becoming known in the underground scene.

3. Transition from Hobbyist to Profiteer (09:38 – 18:16)

Hieu started as a “for fun” hacker — exploiting poorly secured websites, leaving “pwned by HughPC” messages.
A forum user convinced him hacking could be lucrative, leading to the monetization of his skills by stealing and selling credit card data from vulnerable e-commerce sites using tools like Google Dorking and SQL injection.
“I put on the customized tool that I programmed … it will give me the list of vulnerable website and then I will exploit it to obtain the red account information.” (12:50 – Hieu)
He laundered stolen card proceeds through online poker “chip dumping” schemes, earning thousands daily with partners, and began selling excess card data on hacking forums for as little as $0.50 per card.

4. Expanding Operations and Facing Consequences (18:16 – 25:49)

Hieu’s activities scaled rapidly; he moved over 100,000 card data records and amassed substantial profits.
Fearing legal consequences and realizing the risk, he used illicit funds to pay for school fees in New Zealand, attempting a “fresh start.”
After a period of behaving, financial pressures drew him back into hacking—this time targeting local New Zealand e-commerce sites.
His undoing came after using stolen cards to buy and resell concert tickets. Victims' complaints led to police scrutiny, prompting Hieu to flee back to Vietnam as a fugitive.

5. Entering the Mega-League: Data Brokers (27:20 – 39:26)

Back in Vietnam and shamed by his family, Hieu tried to reform but was lured back by old acquaintances who suggested targeting U.S. data brokers—companies aggregating vast troves of personal information on Americans.
He performed technical reconnaissance, hacking into brokers like LocatePlus and MicroBuilt via SQL injection and other web attacks.
Armed with thousands of compromised investigator/law enforcement logins, he could look up nearly anyone’s full identity.

6. Building an Illicit Data Broker Business (39:26 – 55:49)

Hieu set up a people-search site for cybercriminal clients, charging $1 per query (data cost him $0.14 via broker).
Payments were handled using Liberty Reserve, an anonymous online currency favored by criminals.
“The first week of him launching this website, he made $5,000 … was making more than $120k per month.” (42:17, 49:58 – Jack)
He automated the business, handling millions of U.S. identities and earning over $3 million, while paying hundreds of thousands monthly to U.S. data brokers.
At one point, he impersonated private investigators and used phishing and malware to gain legitimate broker access, maximizing data extraction.
Most site users were cybercriminals, using the data for identity theft, fraud, and, as later discovered, mass tax refund scams.

7. The Experian Takeover and Secret Service Investigation (59:25 – 63:13)

Court Ventures, a broker furnishing him API access, was acquired by Experian. The Secret Service tipped off Experian to the illicit resale, leading to a shutdown of Hieu’s access and a manhunt.
Hieu tried alternate access methods, but Secret Service agents lured him to Guam with an offer of expanded API access.
Upon arrival, he was arrested—“They told me, ‘We know everything about you, maybe more than your family does.’ … and that moment I say, man, it’s over.” (64:19 – Hieu)

8. The Prosecution and Legal Questions (67:02 – 86:04)

Hieu faced three CFAA (Computer Fraud and Abuse Act) charges related to unauthorized access and profiting from data in excess of $5,000, plus alleged money laundering (never proven as his laundering was outside the U.S).
His lawyer fees exhausted much of his fortune; prosecutors blamed him for $60 million in damages.
“The only real thing here is … you’re saying, hey, I’m just doing an upcharge for this and giving you access to more people. It’s not really stolen data; it’s actually paying for the data as you’re using it.” (74:47 – Interviewer)
Neither data brokers nor companies affected reported breaches or testified; court focused on CFAA violations and the connection to downstream identity theft and tax scams.
Hieu ultimately pleaded guilty, receiving a 13-year sentence but served seven years for good behavior.

9. Reflections and Life After Prison (93:49 – 95:36)

Hieu returned to Vietnam in 2020 with modest remaining assets and worked for the government’s cyber defense center.
Now, he works combating cybercrime and assisting victims, hoping to atone for his past.
“I feel like, you know, I owe a lot to the people … I kind of always feel ashamed about it.” (95:19 – Hieu)

Timestamps – Important Segments

00:10 – 02:01: Hieu’s origins as a young hacker in rural Vietnam
05:58 – 07:23: Discovery of Vietnam’s dark web forums
09:38 – 10:30: Rise on underground forums, becoming an administrator
12:50 – 16:09: First successful credit card thefts and laundering via poker sites
18:16 – 19:41: Selling cards at rock-bottom prices
27:20 – 29:03: Turning point: shift to targeting data brokers
39:26 – 42:17: Hieu’s illicit “people search” engine goes online; first big profits
49:12 – 50:34: “I was making more than 120k per month… more than 3 million USD”
59:25 – 61:26: Experian/Secret Service investigation; Hugh’s backup plans
62:13 – 64:19: The sting in Guam and his arrest
67:02 – 71:05: Charges and prosecution details; questions about actual “victims”
74:10 – 76:08: Host’s frustration with CFAA prosecutions and the ethics of data brokering
82:44 – 83:04: No breach notification from data brokers; secrecy and lack of transparency
93:49 – 95:36: Post-prison life: working on cyber defense, redemption, and public apology

Notable Quotes & Memorable Moments

“The more I say, the more the people, they know about me on these underground hacking forums. And eventually they voted me as an administrator in one of these forums.”
— Hieu (09:38)

“When you click on the record information, it pops out red card information.”
— Hieu on lack of payment security in admin panels (20:17)

“Eventually, I went back on the underground hacking forums. I sell the information. Visa and MasterCard, I sell for like 50 cent for one information. And American Express and Discover, Discover Card, I sell for from $1 to $3.”
— Hieu (18:16)

“Data brokers are just companies trying to make money. They do a great job at hiding their presence … Let me give you an example. I’m going to list eight of them for you. And I bet you’ve never heard of any of these companies, yet there’s a high chance that all of them know exactly what you’re doing right now.”
— Jack (35:00–36:00, paraphrased)

“The first week of him launching this website, he made $5,000 from people doing searches on it. It was an instant hit.”
— Jack (42:17)

“Back then I didn’t use Bitcoin. We used Liberty Reserve.”
— Hieu (42:39)

“You have to verify everything, but the CEO … gave me a good deal … 14 cent for one information … We make a business contract. I forge the signature … and they didn’t verify anything.”
— Hieu, on obtaining Court Ventures API access (47:59)

“After serving seven years in prison, they let him out in 2020. … When he got home, he got a job with the Vietnamese government to help with their national cyber defense.”
— Jack (93:27–94:05)

“I feel like, you know, I owe a lot to the people, especially the people in the U.S. I kind of hurt and harmed so many people’s lives and I kind of always feel ashamed about it.”
— Hieu (95:19)

Episode Tone & Reflections

Candid and Remorseful: Hieu is frank about his journey, acknowledging wrongdoing and expressing deep regret.
Critical and Analytical: Jack expresses frustration with the “gray zone” of U.S. data broker laws, CFAA misuse, and the moral ambiguity of selling data.
Contemplative: The story spurs broader reflection on privacy, victimhood, and fundamental rights.
Technical, Yet Accessible: The episode explains the nuts and bolts of hacking, data brokering, API use, and laundering schemes in a way that’s digestible for non-technical listeners.

Conclusion

This episode is a gripping, nuanced look at how one person’s curiosity led him to the heart of the world’s data privacy crisis—and how the lines separating legal, illegal, and unethical are often muddier than we like to think. Hieu’s redemption arc, and the ethical debates sparked by his story, leave listeners questioning not just the actions of hackers, but of the massive, shadowy data broker industry that quietly trades in the identities of millions every day.

Recommended Reading (from Jack):
Means of Control by Byron Tao—an eye-opening exposé on the data broker industry.

Memorable Final Words:
"They say if you don’t pay for it then you’re the product. But what if you pay a data broker to look up your own data? What then?" – Jack Rhysider (97:03)

End of summary.

Loading summary...

Transcript

Interviewer (0:00)

I want to make sure I pronounce your name right. So can you say your name for me?

Hugh Mingo (0:04)

My name is Hugh Mingo.

Jack Rhysider (0:06)

Hu was born in Vietnam.

Hugh Mingo (0:10)

I'm growing up in a small town in Vietnam. It's called Cambran. I started to be a hacker when I was very young, maybe around like 14, 15 years old. And then kind of out of curiosity, you know, wondering about how the Internet working. And back then, the Internet is very expensive and super slow. That's one of the reason that I started to hack and steal a few Internet dial accounts to be able to use it without paying anything. That's kind of my first time. I got into trouble when I was like 15 years old.

Jack Rhysider (1:04)

This was around 2004, a time when 56k modems were the most popular way to get online. And the way it worked is you dialed a phone number and connected to the ISP that way. And they would connect you to the Internet, but the ISP would charge you by the minute to go online. Can you imagine that being charged for every minute you're on the Internet? That's how it worked back then. Hugh couldn't afford that, so he figured out a way to use someone else's account, basically stealing someone else's ISP connection to get online. And that meant other people were paying for him to get online.

Hugh Mingo (1:35)

And just like a few months, you know, few months using these stolen Internet type of account, I got kind of like a paperwork sent to my house, and my parents, they got very surprised. And then they told me, what's that about? And then I told them, you know, it's related to some stolen Internet accounts.

Jack Rhysider (2:01)

The paperwork said that Hugh did $5,000 in damage and his father had to pay the fees. That's a lot of money. His father was pretty mad and sent him away to go live with his uncle in Ho Chi Minh City. And little did everyone know, it was going to be there in Ho Chi Minh City, where he was going to build a Darknet service and was going to make a fortune doing it. These are true stories from the dark side of the Internet. I'm Jack Resider. This is Darknet Diaries.

Sponsor/Advertisement Voice (2:59)

This episode is sponsored by Spy Cloud. With ransomware affecting 85% of organizations in the past year and phishing becoming the top entry point to ransomware, taking action on your company's exposure has never been more critical. I recently visited spycloud.com to check my Darknet exposure and was shocked to discover just how much stolen identity data criminal.

Jack Rhysider (30:59)

Data brokers, of course, they would absolutely have a ton of people's identities. Okay, so if you don't know, a data broker is a company that spends an enormous amount of effort gathering up as much information as they can about you. Here's how they do it. Number one, they'll copy the whole phone book into their database that's got everyone's name and phone number. Then they'll take a copy of all the county records. This includes who owns which property, court records, marital status. Then they'll look at your social media account and scoop up any photos that you have taken of yourself and posted email addresses. You list affiliations like which school you went to or place you work. LinkedIn is being scraped by data brokers all day, which you personally have told what your skills are, who your co workers are, where you work and what you look like. Now, to me, that's already spooky enough that someone would go through all this trouble to get all this data on me by doing all that. But some data brokers go far deeper and are way more sinister at getting data on us. They have been known to install trackers on your phone, which typically just comes along for the ride on popular apps. Like a data broker may pay an app developer to put a tracking pixel on the app so that they can track people even more. This means data broker is often collecting cell phone data, which could include your phone number, the app usage, but more interestingly, up to the minute location information. Some data brokers go even further and set up antennas around town and watch what phones interact with those antennas and they can track your phone's location that way. Some have been known to put little sensors on roads to identify which cars have passed down that road and take pictures of license plates going by, too. Of course, purchasing history is important to them. I've heard stories of data brokers buying your purchase history data from retail stores. And if you don't know, a lot of retail stores are very closely tracking all the purchases you make with your credit card and have a complete history of everything you've ever bought with that card in their store. Sometimes they even track where you are in the store and what you stop to look at to see what interests you. And yes, absolutely, data brokers are buying up all this data that the stores are collecting on you because this consumer behavior is worth gold to these data brokers. So why do these data brokers do this? Why do they go to such great lengths to build databases on us? Because there's a lot of people who are willing to buy this data. Your data is very valuable, and I'm not talking about selling it on the dark web. We'll get to that. Data brokers often sell their data to law enforcement, and this has been a growing problem over time. I feel like law enforcement has found a loophole to ignore the fourth Amendment. As a refresher, the fourth amendment says you have a right to privacy from the government. The government should not be able to see into your life without a warrant or probable cause. But they are, through data brokers. There's something called a third party doctrine now which says if you give your data to a third party, you no longer have a reasonable expectation of privacy from that data. So that means if you have money in the bank, the bank can share your data with the government without a warrant. And law enforcement can purchase your location data from a data broker without a warrant because it's commercially available data. Data brokers are trying to ruin the fourth Amendment. And I want you to look a little closer at where this data is coming from. Yes, a lot of it is publicly sourced, but a lot is not. A lot of this data that you think is just private between you and the party you trusted your data with. But they're selling that data to others. And so if you think it's safe and secure, but it's secretly being scraped and sold, I would say that's spying on you, which the government isn't allowed to spy on its own citizens. I mean, mass surveillance is against the law, flat out. But they can get away with it because data brokers are the ones doing the spying and the mass surveillance, not the government, and then they're selling it to the government. Now I've tried to remove my digital footprint as much as possible, but there are still things that I'm forced to do which hurts my privacy and I hate it. Like for instance, anytime I see a doctor, I can't do it under a fake name. They have a strict policy where I have to prove my identity in order to get medical treatment. And then my medical records are being passed around to millions of people. HIPAA isn't there to protect our privacy. It's there to assist others to get our data. The portability part of it means they're making it easy to package up our data and send it to whoever asks for it. And there are millions of people and entities that can access HIPAA and patient data. Second is banks. There are laws in place where the banks have to verify who you are before they do business with, you know, your customer type stuff. And the banks are forced to report certain activity to the government. So millions of customers, banking data is going to the government again without a warrant. Lastly, I hate all this public record stuff. If I buy a house, get married, go to court, start a business, get arrested, all that is public record. And it gets abused all day, every day because it is, I have no choice when it comes to these matters. My banking history, medical information, marital status, there's no way to opt out of any of it. And data brokers are just licking their lips, sucking it up as fast as they can, and they're profiting off of it and they're using it to strip away my rights. But don't think it stops there. Data brokers are just companies trying to make money. So they have no problem selling your data to Walmart, Facebook, Google, insurance companies, credit card agencies, ad agencies. Because all these businesses would love to know more about who you are so that they can target you with ads or to calculate the risk of doing business with you. And these data brokers absolutely do not want you to know they exist. They do a great job at hiding their presence in the world. Let me give you an example. I'm going to list eight of them for you. And I bet you've never heard of any of these companies yet. There's a high chance that all of them know exactly what you're doing right now. Merkle Locate plus, Liveramp Micro Built, Ventel, Safegraph, X Mode, Social Court Ventures. I certainly don't know anything about these companies, but Hugh was learning a lot about them.

Jack Rhysider (51:23)

It makes me wonder, is any of this illegal? I mean, can you squarely point at who the victim is here in this situation? Do you know the story of Irate Joe's? It's an interesting one. So there's this US Grocery store called Trader Joe's. It's fantastic. I love it. A majority of food there at Trader Joe's is the Trader Joe's branded stuff. And people get hooked on that brand. Well, up in Vancouver, Canada, they were like begging Trader Joe's to come open a store here, but Trader Joe's refused. They're like, no, we only focus in the US we're not going international. So some guy in Vancouver is like, well, you know what? I'm going to open my own Trader Joe's in Canada. Why not? Because if they're not going to do business here, then there's probably no jurisdiction issues or harm. Should be fine. So he crosses the border into Washington state, buys a ton of Trader Joe's stuff and drives it back to Vancouver and opens up a little shop called Pirate Joe's. He charged more than Trader Joe's did because of the logistics of it. But hey, people in Vancouver were happy to get some of their favorite food items. Finally, Trader Joe's was like, hey, you can't do that. And Pirate Joe's was like, yeah, nyah. We're in Canada. Your U.S. laws don't apply here. He was right. Trader Joe's had a really hard time getting anywhere legally. But eventually they convinced a US court to force a trademark infringement on Pirate Joe's, saying the name of the store is too similar to Trader Joe's. And they're smugglers. So what did they do? Pirate Joe's dropped the P and renamed the store to Irate Joe's. And they clearly put all over their store, we are unaffiliated, unauthorized, and unafraid. Trader Joe's was furious that they stayed open and started banning them from coming into the store to buy stuff. They banned the owner, who was driving twice a week to buy $5,000 worth of groceries from Trader Joe's. Then he got his co workers to go to different Trader Joe's and try to buy stuff from there. But Trader Joe's started figuring out which stores in Washington they were visiting and buying food in the shop so they would block these other people from purchasing things. So Irate Joe's started asking their customers to help stock the store. They're like, hey, if you're going to Washington, please pick some stuff up for us at the store. And soon, dozens of people were now helping stock the shelves at Ira Joe's. I'm telling you, people really love Trader Joe's stuff. And crowdsourcing the buying was working for them. But Trader Joe's was putting more and more limits on how much people could buy in the stores that were close to Vancouver. The guy who owned Irate Joe's is like, bro, I'm your biggest customer by far. I buy more than anyone else in the store. What is your deal? We're not asking for anything special. We just want to buy what you have. But Trader Joe's kept giving them legal trouble, and eventually, Irate Joe's shut down from the expensive legal fees that they kept facing. And again, here's a situation where I wonder, who's the victim? Trader Joe's sure thought it was them. But what do you think? I mean, when I was a teenager, I used to buy things from the Dollar Store and then sell them on eBay for $5 each. If it's legal for data brokers to sell identities of US Citizens, why would it be illegal for Hugh to buy those and resell them for more? This is the part I don't get. It's apparently perfectly fine for a data broker to buy and sell identifying information on US Citizens, but it's not for Hugh. In Hugh's case, he didn't hack into the site. He didn't steal anything. He was a paying customer of Court Ventures and was paying them a lot of money for all the searches people did. And they seemed to be fine with that, happy that Hugh was their customer. So he had his little website set up and accepted payment from Liberty Reserve. And users could search Court Venture database through the API.

Jack Rhysider (71:12)

Okay, fine, I will. All right, he's charged with three items here. All three are violations of the CFAA figures, right? The first specifically says he used a data broker in a way that they didn't authorize him to use. It's against their terms of service to resell the data that you're given access to or to impersonate someone to get an account there. And he did that. He absolutely violated their terms of use. And that is what the Secret Service is saying. He's going to prison for unauthorized access, which we can guess means that he impersonated an authorized user, which is against their terms of use. You know how many of us violate the terms of use on websites? We all do all the time. Like, if you ever let someone use your Spotify or Netflix login, that's the same violation, unauthorized access. He's being charged with that sort of thing. Second item, specifically, it says he's personally gained money from violating his access. And the third item is that it was in excess of $5,000. So all three of these are CFAA violations. And it drives me nuts that if you violate a website's terms of service, it's a federal crime. I don't know why. It's not just a civil issue, a problem between you and the website. Like, why is it a federal crime? I think the site has grounds to terminate you, ban you, and probably even sue you for violating their terms of service. But prison time, I think that's just going too far. But that's how it is. It's a federal offense to violate a website's terms of use. And I'd be remiss if I didn't mention Aaron Schwartz here. Aaron was an MIT student, and because he was a student, he had access to academic research papers through a place called jstor. Well, he thought this information was so valuable to the world that he was downloading it and Publishing it for free. The world should have this academic research, not keep it exclusive only for university students. But JSTOR was pissed. They called the feds on Aaron for violating their terms of Service. And the DOJ charged him with 13 felony counts, and he was facing 35 years in prison. They told him, look, if you take a plea deal, you'll probably only do six months in prison. But he absolutely did not want to want a felony on his record. A felony for violating the terms of service. The pressure was too much for him, and Aaron killed himself. So after that, politicians were like, whoa, whoa, whoa, why does the CFAA have it written in there that unauthorized access to a website is a federal crime? People are dying over this. Just because you violated a website's terms of use should not be a federal crime. And so Aaron's law got proposed, which asks to change the CFAA to stop saying that a terms of use violation is a federal crime. But sadly, the law didn't get passed. Can you tell I hate the cfaa?

Jack Rhysider (76:08)

I'm not trying to say he should have gotten off. He absolutely did break the law. What I'm saying is that this is the wrong law to be charging him with, because I hate when the CFAA is used like that. They tried to say he was also in trouble for money laundering, but he didn't do any of his money laundering in the US So I'm not sure if that one even flies. But, like, none of his charges were for any of the credit cards he stole or drained. All those sites that he hacked into back then. There's nothing about all the concert tickets that he bough and then essentially scammed all those people. Like, those are easy charges to slap him with, yet they're completely absent here. There is a law around identity theft, but I think it would be hilarious if they charged him with that, since that's the whole business model of what data brokers do already, right? They work every day to grab as many identities as they can without anybody's permission and then sell them. And not only that, he didn't steal the identities, he paid for them. So the theft part would be in question too. I think the proper crime here that they probably should have charged him with is that he was knowingly helping criminals conduct crimes, right? Like aiding and abetting and conspiracy, that sort of thing. Hugh knew his site was used by criminals, and they were his favorite customers because they would pay for tons of searches. So he was catering to them, making it easier and better for them to use his site. So while he didn't do any of the tax fraud himself, he did help a lot of people do it. But he wasn't being charged with aiding and abetting. He was being charged with violating the terms of service of a data broker where he was impersonating someone else to get an account there. But the thing is, the Feds would have a much harder time proving his site was intended for criminal use compared to simply giving him a CFAA violation, which is easy to convict someone of. Like I said, we all violate the CFAA all day, every day. So in my opinion, the feds charged him with the wrong crime because of the almost guaranteed win for Them, as opposed to charging him with the right crime and then struggling to find evidence to prove that he did that. And by the way, while the Fed said that he caused $60 million in damage, nobody was asking for restitution there. None of the data brokers were saying he caused them damage. So if he did do all that damage, find that victim and bring them into the case. Because here's the thing, I'm looking at the indictment and there's not a single company name here or victim name listed at all. Of course not, because the data brokers want to hide from you. So the only thing listed there is company A headquartered in New Jersey. And it said he did an SQL injection on company A. Well, by doing a little bit of research, it's kind of easy to figure out that the data broker in New Jersey that they're talking about is US infosearch, which Hugh did in fact steal credentials and use that site, but not much at all. I mean, it was such a small blip in his story that it's hardly worth mentioning yet. That's the company that was saying he got unauthorized access to. But here's the thing, here's how it all connects. Court Ventures was partnered with US InfoSearch. If you are a paid Court Ventures user and you look someone up, they had a connection to US InfoSearch, so you'd get results from them too. Now, I'm just connecting the dots here, but that sounds like to me that Court Ventures was reselling data broker information that they got from US Infosearch. Like surely whatever deal they had with US infosearch, they were selling that data for a higher price to their own customers. Right. You see my point? This story is pretty bizarre. So you could say this company listed in the indictment, US InfoSearch, was the back end and provided data to Court Ventures. And it's US Info Search that the US Government is saying Hugh got unauthorized access to and profited off that access.

Jack Rhysider (86:04)

After pleading guilty, he was sentenced to 13 years in prison. 13 years for getting access to data broker data, which he wasn't authorized to access at this point. I'm wondering, what if instead of Hugh accessing data broker data to sell that, what if he just made his own data broker business, you know, for anyone to access? Would that be illegal? Like, if Hugh copied all the data out of the phone book and all the court records and the county records and scraped some LinkedIn data to build complete profiles on millions of people? That's all public information. Right. And it wouldn't have been that hard for him to do because he's A clever guy. Are there laws that he would be breaking if he sold that data? I guess what I'm wondering is, are there laws that data brokers have to follow? Well, I had to stop and look into that. Basically, yes. There are data broker laws, and often states regulate them. And the gist of the laws is that data brokers have to prove that they aren't selling their data to criminals. I mean, think about all the dangerous household things we probably all have, right? Box cutters, a hammer, matches, lighters, gasoline, bleach. These are all things that can cause a lot of harm and destruction, right? Yep. When you go to buy them, the store doesn't verify your intent. They're not like, hey, what are you going to do with that box cutter? You have to prove to us that you're going to put it to good use. Yet that's how data brokers treat their customers. Their customers have to show proof that they have a legitimate reason to search their data, and they're on the approved list of okay people. Apparently, it's not good enough for data brokers just to say, hey, you can't use this for malicious intent. They have to verify every single user to try to prevent any of them from using the data maliciously. So the approved list is people like law enforcement, marketers, investigators, loan agencies, those sort of people. And that distinction is very fascinating to me. Data brokers are legal, but only if they sell their data to an exclusive group of people. And I don't like that, not one bit. I mean, of course I don't like that there's a business out there buying and selling my personal information. That's gross. Go get a real job. All right, But I think I might have a hot take here. I don't like that they only sell their data to a certain group of people. I wish they sold it to anyone. Only people in some exclusive club can look up my data. A club that I'm not allowed in. I mean, the reason why states regulate data brokers is because if anyone could search those databases, then we'd all be flooded with scammers and identity thieves and stalkers. But to me, that's not the problem. To me, the problem is, one, I don't even know how much data those data brokers have on me. And two, I don't even know who has my data. Like, if I could somehow feel the sting and pain every time my privacy is lost, I would take my privacy way more seriously. So, like, I know there's probably apps on my phone that are sending real Time location data right now to a data broker. And if someone took that data and saw where I was and came to my house and knocked on my door, of course I wouldn't answer because I.

Jack Rhysider (89:17)

But I just imagine them continually pounding on the door like, hey, I know you're home. Answer the door. Your phone is sending me real time location data to me right now. I'd immediately be like, wait, what app is sending you my location data? And I think having a scary moment like that would absolutely force me to uninstall apps that are tracking me. So my hot take is that stalkers aren't the problem here. It's the obsessive collection of my data that's the problem. If data brokers opened themselves up to let anyone search their site, we'd all be way more private and secure because we'd all be taking huge steps into protecting our privacy way more seriously. When we don't know what's out there, we don't think it's a problem, and they're trying to hide that from us. Of course, the data brokers say they take our privacy seriously and security is their top priority. Yeah, well, until it isn't. Hugh got into four different data brokers all by himself, and it didn't look like it was that hard for him to do. Not only that, there's news story after news story of data brokers getting hacked into. The biggest one is when Equifax got breached. If the data brokers were so worried about their data getting into the wrong hands like scammers and stalkers, then don't collect it at all. Because if there's one thing I've learned about doing over 160 episodes on hacking is that you will fail at securing your network and data at some point. There is no safe way to collect and store my personal data, much less sell it. The regulators think forcing data brokers to vet every user is stopping criminals from accessing the data. But clearly criminals are in fact accessing the data. Since when do criminals follow regulations? So really, all the regulations are doing is stopping people like you and me, normal citizens, from being able to see what's in there. There are so few people who truly understand what is happening in this data broker world, since they like to operate in the dark, in the shadows of the Internet, and they work hard to keep everyone else in the dark. I want to believe that someday privacy will be in style again and we just need enough cool people to tell us it's worth wanting. Because data brokers has a bad aesthetic. Surveillance is sterile. It's cold, gray and depressing. There's nothing cool or romantic or aspirational about being trackable down to when you're peeing or having sex or eating or sleeping. Yet these data brokers are feverishly trying to know all of that about you and build a complete behavior profile on you and then selling that to millions of people who are on the allowed list. I hope someday wanting privacy doesn't make you a weirdo, but it makes you cool. Hugh was sentenced in 2015, which meant he'd get out in 2026, because he already spent two years in prison by that point. And it was there in the New Hampshire prison where he learned English and studied all kinds of things. The police asked if he could share his story with others to teach them how the darknet works and all that. So he cooperated and told his story and was trying to self rehabilitate to get out early. But when he was in prison, he heard some news which really crushed him. That Liberty Reserve website was seized by the Feds and the owner was caught.